Founder @Binary_Defense @TrustedSec. @WeHackHealth Pod. God + Family/Hacker/CSO/USMC/Intel/Fitness. Make the world a better place.
Fairlawn, OH
Joined July 2009
- Tweets59.2K
- Following6.3K
- Followers234K
- Likes206K
Dave Kennedy retweeted
the stars are lining up for GPT-6.2 this weekend
Tibo's 28-day challenge ends November 1st, and the leaks are all pointing at it
> a "gpt-6.2-betelgeuse" model is reportedly showing up internally (unconfirmed)
> GPT Image 2.6 just showed up in OpenAI's API docs, right after "aurora" and "shooting-star" image models hit Arena
the name fits too, Sol, Luna, Terra and Astra are all space names, and Betelgeuse is a red supergiant star that's about to go supernova lol
day 28 is the end of the challenge and the start of a new month, the perfect time to go big
my guess is GPT-6.2, GPT Image 2.6, and one last reset to close it out
3 days to find out
Dave Kennedy retweeted
We are heading to Cincinnati for @qc_con on November 13! @HackingDave will be giving the opening keynote titled "I-Pocalypse or Cybersecurity 2.0?" at 10am. Hope to see you there! Find out more: hubs.la/Q04CPYq10
Dave Kennedy retweeted
Heading to BSides Columbus next week? So are we.
The Binary Defense team will be on the floor November 6th, and we want to hear what’s keeping you up at night. Alert fatigue, stretched-thin teams, threats that show up at 2 a.m. on a holiday weekend. Bring the tough questions and we’ll bring straight answers.
Stop by to see how NightBeacon keeps a human-first defense working for you around the clock, so your team can focus on what matters most.
Columbus, let’s talk shop. See you there.
Dave Kennedy retweeted
Hey Pittsburgh! If you are heading to WITCON next week, make sure you don't miss our own @InfoSteph1 on this panel at 2pm where she'll share her experience navigating a technical career in cybersecurity. Tickets available here: hubs.la/Q04CPrKk0
Dave Kennedy retweeted
What could the next 6 months hold for AI?
That question took center stage at yesterday’s Cybersecurity Summit with the @cavs. Thank you to everyone who joined us, and to our panelists for sharing their perspectives.
Proud to be the Official Cybersecurity Provider for the Cavs!
Dave Kennedy retweeted
The team is on the floor at @SAINTCON! If you haven't had a chance yet, stop by our booth and say hello! Plus, catch our Founder and CEO @HackingDave on stage today at 3:30PM for “Uncharted Territory: AI Now and in the Future.” See you there! hubs.la/Q04CMsgl0
Dave Kennedy retweeted
In SaaS, attackers don’t break in—they sign in. Check out our own @H3xxEdit joining @Antisy_Training’s Anti-Cast on November 4 at 12:00PM ET to dive into token theft, OAuth abuse, and API exposure in SaaS incident response investigations. Register now! hubs.ly/Q04CGqY70
Dave Kennedy retweeted
In our next webinar on Nov 4, our experts break down the security considerations for Claude and Copilot. You will walk away knowing what these tools can do, where the risks hide, and which controls matter most for your security needs. Register now! hubs.la/Q04CFZm90
Dave Kennedy retweeted
Is AI the end of CTFs, or just their next evolution? 🚩
Director of Software Security Scott White and Security Consultant Jarrod Rizor join this episode of #SecurityNoise to talk about how AI is changing the game.
🎧 hubs.ly/Q04CzpxF0
Dave Kennedy retweeted
We’re heading to Cincinnati as a proud Ruby Sponsor of @qc_con, November 13-15! Three days of talks, workshops, and hands-on learning await. Come find the team at our booth throughout the conference and say hello 👋 hubs.la/Q04CwZqF0
Dave Kennedy retweeted
We're a little over a week away from @BSidesColumbus—check out this two-day training you won’t want to miss! Join @curi0usJack and @L1NKD34D for “Supply-Chain to Runtime - RedTeam." Check it out and register now! hubs.la/Q04CvFdk0
Dave Kennedy retweeted
Three questions every government contractor should be able to answer about #CUI—how to identify it, when to mark it, and how to handle it correctly. In our newest blog, Chris Camejo answers all three from a contractor’s perspective. Read it now! hubs.la/Q04CsWmX0
Dave Kennedy retweeted
Automating security decisions with AI won’t always give you the best containment scenario. AI should inform, but humans still need to make the critical decisions.
That’s exactly how NightBeacon CMD operates. It provides the evidence analysts need to make an informed decision. But the analyst still owns the decision.
See how NightBeacon CMD works: binarydefense.com/nightbeaco…
Dave Kennedy retweeted
Tomorrow is the last @ISC2 Cleveland Chapter meeting of the year, and you won’t want to miss it! Join us at our HQ in Fairlawn for Matt Lee and Tom Lawrence's talk, “Giving Swords to Our AI Overlords.” Register now and we'll see you tomorrow at 5:30PM! hubs.la/Q04CjcW00
Dave Kennedy retweeted
Adversaries may gain access to NSS and DIB network devices through SNMPv1 and SNMPv2c read-write community strings. Keep your networks secure by upgrading to SNMPv3 which includes encryption and authentication. media.defense.gov/2022/Jun/1…
ALT The image shows a comparison of three types of Simple Network Management Protocols (SNMP). SNMPv1 and SNMPv2c are marked with red "X" symbols, indicating disapproval. SNMPv3 is marked with a green check mark, indicating approval.
Dave Kennedy retweeted
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hashcat/b…
Download: hashcat.net/hashcat/
Dave Kennedy retweeted
Should we have a funeral for CTFs? On the next episode of Security Noise, we sit down to discuss if and how the use of AI has sent Capture the Flags (aka CTFs) to an early grave 💀 Tune in next week wherever you get your podcasts or watch on YouTube! #SecurityNoise
Dave Kennedy retweeted
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.
The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.
This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.
More details on the patch and mitigations below:
patchtheplanet.org/brotli
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ou…
Dave Kennedy retweeted
If you're looking at an updated Node.js, and calling CVE-2026-111497 done? We have some bad news: We likely don't even know the true scale of "Node2Shell" yet.
Node patched CVE-2026-111497 on Oct 21. But the CVE wasn't in Node, it was in Brotli. So our researchers Diptendu Kar and Kurt Boberg went looking for every other package that bundles the same vulnerable Brotli decoder. Here's what we found
433 package entries across 12 ecosystems not great but the absolute worse part: Many of them don't even have fixes available yet. Now are they all reachable and exploitable? Probably not, we're finding out. But the important part: Node isn't the only affected runtime or package, not even close.
We're working through the list to manually verify each one but so far we're looking at a 71% no fix yet rate, of the fixes most are still in alpha/early releases.
The problem is most implementations aren't even called "brotli." The decoder is compiled into other runtimes like Chromium. 38 entries bundle Brotli older than 1.0.3. Some of those copies date to 2016, and of course are vulnerable to more than just this CVE. And there's no easy well to tell if you're affected.
For example, 19 are WebAssembly builds, where memory corruption exists, but stays inside the sandbox. Some require explicit configurations to enable Brotli compression and they aren't on by default. But it's not obvious unless you are looking for it and testing for it. We're going to keep validating (and producing rules), but it's going to be a rough weekend for incident responders.
